.PCAP File Format – File header

libpcap packet capture

A PCAP file starts with one header of 24 bytes. It says how to read every packet record after it: the byte order, whether timestamps are in microseconds or nanoseconds, the longest packet kept, and the kind of link the packets came from. The layout is the one in the tcpdump project’s pcap-savefile manual page and the IETF draft that describes the format.

Fields

All numbers are unsigned and in the byte order of the machine that wrote the file; the magic number shows which order that is.

  1. 0Magic number4
  2. 4Major and minor version2 + 2
  3. 8Reserved1 and Reserved24 + 4
  4. 16SnapLen4
  5. 20Link type and FCS information4
The 24-byte PCAP file header.
OffsetSizeTypeNameDescription
04uint32Magic number0xA1B2C3D4 for microsecond timestamps or 0xA1B23C4D for nanosecond timestamps. See magic numbers.
42uint16Major version2.
62uint16Minor version4 in files written today. See versions.
84int32Reserved1Written as 0; readers must ignore it. Older descriptions called it thiszone, “GMT to local correction”, and some old writers put a time zone offset here.
124uint32Reserved2Written as 0; readers must ignore it. Older descriptions called it sigfigs, “accuracy of timestamps”, and some old writers stored a value here.
164uint32SnapLenThe snapshot length: the most bytes kept from any one packet. Longer packets are cut to this length. It must not be 0. When no limit was set, it should be at least the length of the longest packet in the file.
204uint32LinkType and additional informationThe low 16 bits are the link type of every packet in the file; the high 16 bits are the FCS information.

Magic numbers

A reader takes the first four bytes as a number in its own byte order. If it gets one of the values below, the file is in its own order; if it gets the value with its bytes reversed, every multi-byte number in the file must be swapped.

ValueBytes in a little-endian fileBytes in a big-endian fileMeaning
0xA1B2C3D4D4 C3 B2 A1A1 B2 C3 D4Standard PCAP: timestamps in seconds and microseconds.
0xA1B23C4D4D 3C B2 A1A1 B2 3C 4DStandard PCAP with timestamps in seconds and nanoseconds. Everything else is the same.
0xA1B2CD3434 CD B2 A1A1 B2 CD 34Alexey Kuznetsov’s modified format, from patched Linux tools: the same file header, but each packet record header is 24 bytes. libpcap and Wireshark read it.
0xA12B3C4D4D 3C 2B A1A1 2B 3C 4DNavtel Communications’ format, with nanosecond timestamps. Defined in libpcap’s source but not read by it; its layout is not publicly documented.
0xA1B234CDCD 34 B2 A1A1 B2 34 CDReserved in libpcap for another modified format (Francisco Mesquita’s). Not read; no layout is published.

libpcap also defines 0xA1B2C3CB for its cbpf-savefile format, which holds a compiled packet filter, not packets.

Versions

The current version is 2.4, and today’s writers put 2.4. libpcap reads versions 2.0 to 2.4 and one odd value:

VersionDifference
2.0 to 2.2The two length fields of every packet record are the other way round: the original length comes first, then the captured length. They were swapped at 2.3 to match the BSD packet filter’s header. AIX’s tools write version 2.2 files.
2.3Some files were written as 2.3 with the old order and some with the new. libpcap swaps the two lengths of a record only when the captured length is greater than the original length.
2.4The current version, laid out as on these pages.
543.0Written by DG/UX’s tcpdump, with the lengths in the pre-2.3 order.

libpcap rejects any other version.

Link type and FCS bits

The last field is split into bit fields. Bit 0 below is the most significant bit of the 32-bit number.

BitsMaskNameMeaning
0–30xF0000000FCS lenHow many 16-bit words of frame check sequence are at the end of each packet, 0 to 15. Valid only when P is set. Ethernet’s 4-byte FCS is 2.
40x08000000RNot used. Written as 0; readers must not interpret it.
50x04000000PSet when FCS len is given. When clear, nothing is said about an FCS.
6–150x03FF0000Reserved3Written as 0. libpcap rejects a file where these bits are not 0.
16–310x0000FFFFLink typeThe link-layer header type, a LINKTYPE_ value from the register, for example 1 for Ethernet.

Example

The header of a little-endian capture of Ethernet traffic with a snapshot length of 65,535 bytes. The marked bytes are the magic number.

00000000  D4 C3 B2 A1 02 00 04 00 00 00 00 00 00 00 00 00  ................
00000010  FF FF 00 00 01 00 00 00                          ........
A PCAP file header.

Reading it: magic D4 C3 B2 A1, so the file is little-endian with microsecond timestamps; version 2.4; Reserved1 and Reserved2 both 0; SnapLen 0x0000FFFF, 65,535; link type 1, LINKTYPE_ETHERNET, with no FCS information.